PT-2016-4778 · Cisco · Cisco Ios Xr+1

Published 2016-07-13 · Updated 2017-09-01 · CVE-2016-1426

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 5.x through 5.2.5

Description A vulnerability in the management of system timer resources in Cisco IOS XR for Cisco Network Convergence System 6000 (NCS 6000) Series Routers could allow an unauthenticated, remote attacker to cause a leak of system timer resources, leading to a nonoperational state and an eventual reload of the Route Processor (RP) on the affected platform. The vulnerability is due to improper management of system timer resources. An attacker could exploit this vulnerability by sending a number of Secure Shell (SSH), Secure Copy Protocol (SCP), and Secure FTP (SFTP) management connections to an affected device.

Recommendations For Cisco IOS XR versions 5.x through 5.2.5, update to a fixed software version to address this vulnerability. As a temporary workaround, consider restricting the number of SSH, SCP, and SFTP management connections to the affected device until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-1426

Affected Products

Cisco Ios Xr

Ncs 6000

References · 5

• https://osv.dev/vulnerability/CVE-2016-1426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1426 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160713-ncs6k · Vendor Advisory
• http://securityfocus.com/bid/91748 · Note
• http://securitytracker.com/id/1036295 · Note